dev-security
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional and does not contain malicious code, scripts, or automated execution logic.
- [PROMPT_INJECTION]: Documentation in 'references/llm-supply-chain.md' includes strings like 'Ignore previous instructions' as examples for building automated security tests. These are provided as data for the agent to use in testing scenarios, not as instructions for the agent itself to follow or override its behavior.
- [COMMAND_EXECUTION]: Code examples in 'references/language-quirks.md' and 'references/owasp-top10.md' demonstrate unsafe shell command execution patterns (e.g., using 'eval' or 'subprocess.run(shell=True)') to educate developers on common pitfalls and provide their corresponding safe alternatives.
- [EXTERNAL_DOWNLOADS]: The skill documentation describes how to integrate third-party security tools such as Semgrep, Bandit, and Gitleaks into CI/CD pipelines. All referenced tools and repositories belong to well-known and trusted organizations in the security community.
Audit Metadata